VMware vSphere and Entrust CloudControl: Integration Guide

1. From the Home tab, select Inventory > vSphere .

2. On the vSphere page, select Actions > Add vCenter .

1. On the Configure page , view and approve the certificates for the Platform Services Controller (PSC) and all vCenters that were discovered.

2. The Approve checkbox must be checked for all certificates before you can add the vCenter.

3. Certificates from a trusted source have the Approve checkbox checked automatically.

4. Select the Certificate link to view the certificate details.

   Certificates without a certificate authority are displayed with a warning icon. Select the link in the tool tip to add a CA. You can manually approve these certificates by checking the Approve checkbox. Certificates that are invalid or expired are displayed with an error icon. These certificates cannot be approved. All vCenter and PSC certificates are displayed on the Certificate Authorities tab on the Certificates page.

5. Select Approve to populate the approve checkbox for the certificate, or select the x icon to close the window.

6. Determine if you want to use a single Published IP for each vCenter or a Published IP Range to be used for all current and future vCenters in this ELM.

   If you plan to use Access Control, you must have a Published IP address or range.

7. For a Published IP, select the Configure link in the Published IP column of the vCenter table, enter the Published IP Address and Netmask, and select Apply .

8. For a Published IP Range, enter the Published IP Address and Netmask in the Published IP Range section.

9. Enable Tag Sync if you want vCenter Tags in CloudControl.

10. When all certificates are approved, select Continue .

Check the online documentation instructions for more detail on Adding vCenters to CloudControl .

On the Details page, you can monitor the process as all of your vSphere information is collected.

Select Continue .

On the Onboard Hosts page, you can view the hosts that were discovered, remove hosts, or add additional hosts to be added to CloudControl. Select the hosts that you want to add and select Onboard Hosts .

On the Hosts Credentials page, you can add or import the credentials for your ESXi hosts.

To add credentials:

To import credentials:

Once the vCenter Published IP is set/enabled, you can test it by pointing your browser to:

When you know the ports that were assigned when you enabled GPIP, you can log in to any ESXi using the GPIP and the https_port:

Check the online documentation for more details on connecting to the ESXi hosts using the GPIP .

If CloudControl is not in AD mode, use one of the local users in CloudControl. If local users have not been created you can use the superadminuser local account with the password set during CloudControl configuration. Initially users will have to be in the ASC_SuperAdmin group to be able to log in using GPIP and PIP. You can change this when you implement your own access control policy.

Go to the Home tab, select Security > Log Analysis .

Check the online documentation for more information on log analysis .

To view the system logs page, from the Home tab, select System > System Logs .

Check the online documentation for more information on system logs .

Three users were created in the system that will allow to implement and demonstrate the access control policy in action.

Two users belonging to the ASC_NetworkEngineer . One user belonging to the ASC_NetworkAdmin group. And lastly, the superadminuser (which already existed) which belongs to the ASC_SuperAdmin group.

Tags will not be used in the example but here is an example of how to create a tag and assign it to a resource in the system. For instance, once assigned, you could use tags to constrain the access control policy to resources that have the tag.

Let’s create a tag called ESXi_Host and the tag will be used to tag the ESXi Hosts in the system.

Check the online documentation for more information on: tags .

• Creating the tag

  Here are the details on the tag created:

• Tag the ESXi Hosts with the tag created

  Now tag the ESXi Hosts in the system with the ESXi_Host tag created.

1. From the Home tab, select Security > Trust Manifests .

2. On the Manage Trust Manifests page, select Actions > Create Trust Manifest .

3. On the Details tab of the Create Trust Manifest page, enter the name and optional description for the trust manifest.

4. Select Access Control in the Policy Type field.

5. In the Access Control Policy section, create a rule for the NetworkAdmin Group according to the image below:

6. Add the rule for the SuperAdmin group to the policy, by clicking on Add Another Rule .

7. Select Validate to validate the policy.

8. Select Save to save the policy.

9. Select Publish to publish the policy. When you publish the policy it will ask you to assign resources to the policy. Select host and select Assign .

10. Select Close .

Check the online documentation for more details on Creating an Access Control Trust Manifest from the CloudControl GUI .

When the access control policy is in place, point your browser to the GPIP address of the ESXi host and see if you can log in.

• Success

  Login should be successful for the superadminuser and testuser .

• Failure

  Login should fail for the testuser2 and testuser3 local users.

You can use the Logs in the system to check why access has been denied to a user. In our example testuser2 has been denied access. To find out why, you can view the logs and see what happened.

1. From the Home tab, select Security > Log Analysis .

2. Select the record that shows the Deny Status to see the reason for the denial.

3. You will be able to see the My Access Control Policy was used to control the access.

1. From the Home tab, select Security > Trust Manifests .

2. On the Manage Trust Manifests page, select Create Trust Manifest (The Plus sign in the GUI).

3. On the Details tab of the Create Trust Manifest page, enter the name and optional description for the trust manifest.

4. Select Secondary Approval in the Policy Type field.

5. In the Secondary Approval Policy section, complete according to the image below:

   1. Select the testuser as the subject.

   2. Select the superadminuser as the approver.

   3. Select the Compute.Hostsystem.Login as the operation.

6. Publish the policy.

7. When you publish the policy you must assign resources to it. Select host as the resource. This will make policy applicable to any ESXi host in the system.

When the secondary approval policy is in place, point your browser to the GPIP address of the ESXi host and see if you can log in. Log in with the user that you used in the policy definition. The attempt should fail.

When we try to validate the secondary approval policy, the login attempt failed. The secondary approval needs to be approved before the user can log in to the ESXi Host.

1. From the Home tab, select Security > Secondary Approval Requests .

2. On the Secondary Approval Requests page, you can do the following:

   1. Select the tabs to view Pending or All requests.

   2. Approve a pending request by selecting the request and clicking the Approve button.

   3. Deny a pending request by selecting the request and clicking the Deny button.

After the secondary approval request is approved, log in:

Point your browser to the GPIP address of the ESXi host and see if you can log in. Log in with the user that you used in the policy definition. The attempt should be successful.

CloudControl uses templates to support all Configuration Hardening activities. CloudControl supports the following types of templates:

• Catalog templates—Read-only collection of hardening operations. There is a vSphere operations catalog of templates that you can use.

• System templates—Read-only collection of operations derived from a catalog template for a given compliance standard, for example, the vSphere - HIPAA Security Standards template is derived from the vSphere operations catalog template.

• Custom templates—Templates created by users. In most cases, they are copied or cloned from existing system or catalog templates. Custom templates can be modified and used in configuration hardening policies.

Templates can contain both assessment and remediation hardening operations. It is recommended that you review all operations in the template to ensure that any parameter values are set to those that appropriate for your infrastructure requirements.

Configuration Hardening Policies are used to run custom templates. Each policy associates a template with one or more resources or tag-based resource configurations, and can be run manually or as a scheduled activity. Policies can either assess or remediate a resource, but cannot do both.

Consult the online documentation for more information on Configuration Hardening .

For this guide a configuration hardening policy will be created based on one of the templates available. Enforcement will be based on a rule in the template to check and make sure the ESXi vSphere version is at least version 7 and above.

1. From the Home tab, select Security > Configuration Hardening .

2. On the Configuration Hardening Management page, select the Policies tab.

3. Select the Create (+) button.

4. In the Create Policy wizard on the Select Type page, select the type of policy that you want to create. This can be one of the following:

   • Assess Only - Runs operations on the host to compare the parameter values specified in the template with the actual values on the host.

   • Remediate Only - Modifies the parameter values on the host in order to match the values specified in the templates.

5. Select Assess Only .

6. Select Continue .

7. On the Details page, enter the name and optional description of the policy, and specify whether the policy is enabled.

8. Select Continue .

9. On the Templates page, select the resource type for the policy. This can be one of the following:

   • AWS Account - Runs AWS-related templates against your AWS environment.

   • ESXi - Runs vSphere related templates against your ESXi hosts.

   • Kubernetes - Runs Kubernetes related templates against your Kubernetes environment.

   • NSXDataCenter - Runs NSX-T related templates against your NSX-T environment.

10. Select ESXi as the template to run against your environment.

11. The template list displays the name, description and type of operations. You should select a template that contains the type of operations that you selected for the policy.

12. Select vSphere - HyTrust Best Practice template. This template will be used for our example.

    Note	See the online documentation for more information on Creating a Custom Template .

13. Select Continue .

14. On the Assignments page, select one of the following radio buttons and choose what resources to which you want to apply the policy:

    • Tags - Select the Tags radio button and then choose a tag or tags assigned to the resource. Select the + icon if you want to assign more tags to the resource. If there are no tags assigned, you can select the Assign Tags Now link.

    • Resources - Select the Specific Resources radio button and then choose one or more resources. Note: For vSphere only, you can choose a parent for the resource type. This can be one of the following:

      • vCenter - Allows you to select all ESXi hosts in the selected vCenter. All onboarded ESXi hosts in the selected vCenter will be considered for hardening. You can select multiple vCenters. When the Configuration Hardening policy is run, CloudControl retrieves all onboarded ESXi hosts from the vCenter inventory to ensure the list of ESXi hosts is always current.

      • Appliance Root - Allows you to select all ESXi hosts under Appliance Root. All onboarded ESXi hosts will be considered for hardening. When the Configuration Hardening policy is run, CloudControl retrieves all onboarded ESXi hosts from the vCenter inventory to ensure the list of ESXi hosts is always current.

      • DataCenter - Allows you to select all ESXi hosts in the selected DataCenter. All onboarded ESXi hosts in the selected vCenter will be considered for hardening. You can select multiple DataCenters. When the Configuration Hardening policy is run, CloudControl retrieves all onboarded ESXi hosts from the vCenter inventory to ensure the list of ESXi hosts is always current.

      • Cluster - Allows you to select all ESXi hosts in the selected Cluster. All onboarded ESXi hosts in the selected Cluster will be considered for hardening. You can select multiple Clusters. When the Configuration Hardening policy is run, CloudControl retrieves all onboarded ESXi hosts from the vCenter inventory to ensure the list of ESXi hosts is always current.

      • ESXi Host - Allows you to choose which individual ESXi hosts that you want to use as a resource. If additional ESXi hosts are onboarded, they will not be included.

15. Select Tags for the resources you want to apply the policy.

16. Select the Assign Tags to Policy Now link to select the tags.

17. The Assign Tags dialog pops up. Select the tag created earlier: ESXi_Host .

18. Select Continue .

19. Select the Tag value True that applies to the ESXi_Host tag.

20. Select Assign .

21. Select Continue .

22. (Optional) For vSphere only. On the Resource Constraint page, choose which tag-based resource constraints that you want to use for your ESXi hosts. This option is not described in detail.

23. Select Continue .

24. On the Schedule page, select if you want to enable a recurring schedule.

25. If enabled, select the type of schedule that you want to use to run the policy, and then specify the start date. This can be one of the following:

    • Daily - The policy will run every day at the time that you specify.

    • Hourly - The policy will run periodically throughout the day, based on the schedule you define.

    • Weekly - The policy will run on every day that you select at the time that you specify.

26. Select Create .

27. The newly created policy will be displayed on the Policies tab.

28. Edit the Check ESXi Patch Version Rule in the template. Select the vSphere - HyTrust Best Practice link in the Template Column. This should display the template details.

29. Under Summary of Operations look for Check ESXi Patch Version .

30. Once you find it, select the Check ESXi Patch Version link to edit the rule.

31. Select the Params tab and enter the version according to the image below.

32. Select Save and Close .

33. Now when the Configuration Hardening Policy runs, this rule will check to see if the version of the ESXi Host will match what is on the version field of the rule.

    When you run a remediation policy, the assessment policy will automatically run immediately following its completion. This ensures that your compliance score is updated with the new percentage.

    • From the Home tab, select Security > Configuration Hardening .

    • On the Configuration Hardening Management page, select the Policies tab.

    • Select the Policy that you want to run.

    • Select Actions > Run Now .

    • In the confirmation window, select Run Now .

    • You can view the results by selecting the link in the Last Event column.

      Note	If you used resource constraints on your ESXi hosts, you can see which hosts were analyzed and which were skipped.

    • As you look to the results, you will be able to see that the ESXi Version test that was in the policy, Passed .